HP AE370A HP StorageWorks Fabric OS 6.x administrator guide (5697-0015, May 20 - Page 178

3. Respond to the prompts as follows: Server Name Enter the name or IP address of the FTP server, or SSH server for SCP, where or IP Address the firmwarekey file is stored; for example, 192.1.2.3. Download from USB Optional: -U (upper case) Specify this option if you want to download from the USB device attached to the active CP. Network protocol Specify the file transfer protocol used to download the firmware from the file server. Valid values are FTP and SCP. The Values are not case-sensitive. If "-p" is not specified, firmwarekeyupdate will determine the protocol automatically by checking the config.security parameter on the switch. User name Enter the user name of your account on the server; for example, "JaneDoe". File name Specify the fully qualified path name of the firmware directory, for example, /pub/firmwarekey/pubkey.pem,12345. Absolute path names may be specified using forward slashes (/). Password Enter a password. This operand can be omitted if firmware is accessible through USB or if no password is required by the FTP server. This operand is required when accessing an SSH server. The firmwareDownload command As mentioned previously, the public key file will need to be packaged, installed, and run on your switch before downloading a signed firmware. When firmwareDownload installs a firmware file, it needs to validate the signature of the file. Different scenarios are handled as follows: a. If a firmware file does not have a signature, how it is handled depends on the "signed_firmware" parameter on the switch. If it is enabled, firmwareDownload will fail. Otherwise, firmwareDownload will display a warning message and proceed normally. So when downgrading to a non-FIPS compliant firmware, the "signed_firmware" flag needs to be disabled. b. If the firmware file has a signature but the validation fails, firmwareDownload will fail. This means the firmware is not from HP or its content has been modified. c. If the firmware file has a signature and the validation succeeds, firmwareDownload will proceed normally. DMM, and Third Party Application images will not be signed. To configure the switch for signed firmware: 1. Log in to the switch as admin. 2. Type the configure command. 3. Respond to the prompts as follows: System Service Default is no; press Enter to select default setting. ssl attributes Default is no; press Enter to select default setting. snmp attributes Default is no; press Enter to select default setting. rpcd attributes Default is no; press Enter to select default setting. cfgload attributes Select Yes. The following questions are displayed: Enforce secure config Upload/Download: Select yes Webtools attributes System Enforce signed firmware download: Select yes Default is no; press Enter to select default setting. Default is no; press Enter to select default setting. 178 Installing and maintaining firmware